Why Most 'Reject All' Cookie Buttons Fall Short of PECR
On a depressing number of UK sites, the trackers have already fired before the cookie banner has finished animating in. Open the network tab, go to more or less any large UK retail, media or ticketing site, and watch what happens before you touch the banner. Requests to Google Analytics, Meta's pixel, or one of a dozen ad-tech vendors are often already out the door.
Click "reject all" a second later and, functionally, nothing changes. The trackers that mattered already got what they came for.
That single observation is worth more than most cookie-compliance checklists, because it points at the actual problem. Having a "reject all" button is not the same as being PECR-compliant. A huge share of UK sites have added the button because someone told them the regulator wants one, without touching the plumbing that determines whether it does anything.
PECR, not UK GDPR, is the cookie law
The Privacy and Electronic Communications (EC Directive) Regulations 2003, specifically regulation 6, is the law that governs cookies and similar technologies in the UK, not UK GDPR. Regulation 6 says you cannot store or access information on someone's device unless you've done two things:
- given them clear and comprehensive information about what you're doing and why
- obtained their consent
That's subject to a narrow set of exemptions (strictly necessary cookies, essentially).
What "consent" means here
PECR itself doesn't define "consent" in detail, so the ICO's guidance imports the UK GDPR standard. Consent has to be:
- freely given
- specific
- informed
- an unambiguous indication by a clear affirmative action
Pre-ticked boxes don't count. Continuing to browse doesn't count. This isn't just ICO opinion dressed up as law: the Court of Justice of the EU reached the same conclusion on pre-ticked boxes in Planet49 (C-673/17) back in 2019, and the ICO has treated it as settled ever since.
On paper, then, "reject all" sitting next to "accept all" looks like job done. In practice it's the start of the assessment, not the end of it.
Failure one: the banner is a UI, not a gate
The most common technical failure is depressingly simple. Consent management platforms (CMPs) work by loading a small script early in the page and deferring everything else until the user makes a choice. That only works if every tracking script actually waits for the CMP's signal.
In a lot of real deployments they don't. Trackers creep in from all directions:
- a marketing team drops in a Google Tag Manager container
- an agency adds a retargeting pixel directly into the template
- someone wires up a heatmap tool with its own onboarding wizard
None of it is registered with the CMP's blocking rules. The banner renders, looks perfectly compliant, and has no actual control over half the trackers on the page.
You can check this yourself in a minute
This is a bug in the ordinary engineering sense, not a legal grey area, and it's the easiest thing to check. Load the page with cookies cleared and the network tab open, and see what fires before you've clicked anything.
If third-party requests to known ad or analytics domains appear before your click registers, the banner is decorative.
Failure two: reject has to be as easy as accept
The ICO's cookie guidance is explicit that "reject all" must be given equal prominence to "accept all". Users must be able to refuse non-essential cookies with the same ease as accepting them, without extra steps. This is the part enforcement has actually bitten on.
Two classic ways to fail it, even when every individual word on the banner is accurate:
- "Accept all" is a solid green button, while "Reject all" is a grey text link two shades darker than the background.
- The first screen only offers "Manage preferences", and a genuine reject option is buried three clicks deep behind a wall of per-vendor toggles.
The ICO has been writing letters
In November 2023 the ICO wrote to 53 of the UK's top 100 most-visited websites, warning that their cookie banners appeared to breach PECR and UK GDPR. Mostly it was exactly this point: banners that nudged users toward "accept" through visual weighting or asymmetric friction.
Most complied. 38 changed their banners in response, and a handful more committed to changes shortly after. The ICO has said it isn't stopping there. By 2025 it had moved on to reviewing the next tier of the UK's top 1,000 sites, with an increasing amount of that screening automated.
If your banner still makes reject harder to find than accept, you are exactly the kind of site this sweep is designed to catch.
Failure three: legitimate interest as a side door
Actually, this bit is the genuinely interesting one, because it isn't a UI bug. It's a framework problem.
Most programmatic advertising on the web runs through the IAB Europe Transparency and Consent Framework (TCF). It lets vendors claim either "consent" or "legitimate interest" as their basis for a given purpose. Click "reject all" on a TCF-based banner and you generally do withdraw consent.
But "legitimate interest" purposes often have their own separate opt-out toggles. Sometimes they default to on; sometimes you have to click through to a secondary screen listing hundreds of vendors individually. A user who clicks the big "reject all" button reasonably assumes they've rejected all. Under many TCF implementations, they haven't.
Why legitimate interest doesn't get you past regulation 6
Legitimate interest is a valid basis for some processing under UK GDPR, but it's largely beside the point for the initial act of setting a cookie. Regulation 6 requires consent for storing or accessing information on the device, full stop. That holds regardless of what legal basis a vendor later claims for processing whatever they read from it.
The ICO's own position has been that legitimate interest is not an appropriate basis for non-essential cookies, precisely because PECR's consent requirement sits upstream of the UK GDPR legal-basis question.
A Belgian court has already found against part of the TCF
The TCF's legal footing has also been directly tested. The Belgian data protection authority fined IAB Europe over the framework in 2022. In May 2025 the Brussels Market Court of Appeal held that the TCF's Transparency and Consent String processing lacked a valid legal basis under GDPR, while stopping short of declaring the whole framework unlawful.
That's a Belgian ruling, not binding UK law. But plenty of UK sites use the same TCF stack, and it's a reasonable indicator of where a strict reading of the equivalent UK rules would land.
DUAA 2025 adds an exemption, and bigger fines
The picture is shifting again because of the Data (Use and Access) Act 2025, most of whose PECR changes took effect from 5 February 2026. It introduces a new exemption from consent for genuinely low-risk uses, such as:
- first-party analytics used solely to improve a website
- cookies that just remember display preferences
Users must still get clear information and an easy way to object.
It's narrower than it sounds. The moment analytics data feeds ad targeting, remarketing, or conversion modelling, consent is still mandatory. That describes most "analytics" set-ups bundled with a marketing suite.
The Act also brought PECR's maximum fines up to UK GDPR levels, £17.5 million or 4% of global turnover. So the cost of getting any of this wrong just went up substantially.
A "reject all" button is a promise
None of this changes the underlying test. Whether the promise is kept depends on three things:
- whether every script on the page actually checks the consent state before it runs
- whether the reject path takes the same number of clicks as the accept path
- whether "legitimate interest" is quietly doing the job "consent" was supposed to do
Most banners get the first thing right and fail one of the other two. Which is why simply having the button has never been the bar.